After this lesson you can explain what a zero-day vulnerability is and why it is uniquely dangerous, describe the CVE vulnerability lifecycle from discovery to patch, distinguish between zero-day and N-day exploits, identify real-world zero-day campaigns (EternalBlue, Log4Shell), explain why maritime OT systems face heightened zero-day risk, and describe the key defences — patch management, virtual patching, and network segmentation.
Every vulnerability we have studied so far — SQL Injection, XSS, DoS, MitM — has a known name, a CVE number, documented attack patterns, and published defences. Security teams can search for them, scan for them, and patch against them. A zero-day is none of those things. It is a flaw in software that its vendor does not yet know exists. There is no CVE. There is no patch. There is no signature in the IDS ruleset. The only people who know about it are the ones exploiting it — and the window between "found by an attacker" and "fixed by the vendor" can last months or years.
The term comes from the developer's perspective: they have had zero days to fix it. For the attacker, that zero-day window is the most valuable time — defenders cannot patch what they do not know is broken, and detection tools cannot recognise what has no known signature. Nation-state hacking groups pay millions of dollars for high-quality zero-days; vulnerability brokers (companies like Zerodium) publish buy prices publicly. A working zero-day for a major mobile OS can exceed USD 2.5 million.
The maritime sector is particularly exposed. Vessels operate software stacks that are updated infrequently — sometimes years behind current versions — because patch deployment requires either a port stop or a satellite-delivered update cycle. An attacker who discovers a zero-day in a widely deployed ECDIS platform or VSAT management interface has a window of exploitation that extends across an entire fleet, often for far longer than would be acceptable on a corporate network.
1. The Vulnerability Lifecycle — From Discovery to Patch
A vulnerability passes through a predictable lifecycle, but the timing at each stage is unpredictable — and the phases where attackers hold the advantage can be long.
2. Zero-Day vs N-Day — Two Different Threats
Vulnerability unknown to the vendor. No CVE. No patch. No IDS signature. Typically used by nation-state actors and sophisticated criminal groups due to the high cost and expertise required to find or purchase them.
Vulnerability is public (has a CVE). A patch exists but has not been applied. The vast majority of real-world breaches exploit N-days, not zero-days — because most organisations patch slowly and attackers know it.
Key insight: Despite the media attention on zero-days, N-days cause far more damage at scale. The 2017 WannaCry ransomware attack — which disrupted hospitals, shipping companies, and national infrastructure — exploited EternalBlue, a vulnerability for which Microsoft had released a patch two months earlier. Organisations that had applied the patch were unaffected. Those that had not were compromised in minutes.
3. Real-World Cases — Zero-Days and N-Days in Action
EternalBlue (CVE-2017-0144) — WannaCry / NotPetya
EternalBlue was an NSA-developed exploit for a vulnerability in Windows SMB (Server Message Block) protocol. It was leaked by the Shadow Brokers hacking group in April 2017. Microsoft had patched the underlying vulnerability (MS17-010) in March 2017 — one month before the leak. In May 2017, WannaCry ransomware weaponised EternalBlue, spreading autonomously across networks without any user interaction. It infected over 230,000 systems in 150 countries within 24 hours.
Maritime impact: Maersk, one of the world's largest shipping companies, was hit by the NotPetya variant (which also used EternalBlue). The attack destroyed approximately 45,000 PCs, 4,000 servers, and 2,500 applications. Maersk was forced to reinstall its entire IT infrastructure — 150 domain controllers, 45,000 PCs — within 10 days. Estimated loss: USD 300 million. The entire port of Rotterdam's APM Terminals was shut down temporarily, halting cargo operations.
Log4Shell (CVE-2021-44228) — Log4j Remote Code Execution
Log4Shell was a zero-day in Apache Log4j, a Java logging library embedded in hundreds of thousands of products — from enterprise software to maritime management platforms. Disclosed in December 2021, the vulnerability allowed unauthenticated remote code execution with a single malicious string in any field that Log4j processed — including HTTP headers, usernames, and log messages. Because Log4j was so widely embedded, most operators did not even know they were running it.
Exploitation timeline: Within 12 hours of public disclosure, mass exploitation began. Over 100 distinct threat actors — including nation-state groups from Iran, North Korea, China, and Turkey — were observed exploiting it within days. The CISA director described it as "the most serious vulnerability I've seen in my decades-long career."
Stuxnet — The First Weaponised Zero-Day Worm
Stuxnet, discovered in 2010 and attributed to the US and Israel, used four zero-day vulnerabilities simultaneously to target Siemens PLCs controlling Iranian nuclear centrifuges. It spread via USB, infected Windows systems silently, and then specifically targeted Siemens Step 7 software — sabotaging the centrifuges while reporting normal operation to operators. It demonstrated that zero-days could be chained to cause physical damage to industrial systems.
4. Why Maritime OT Systems Face Heightened Zero-Day Risk
5. Defences — Reducing Zero-Day and N-Day Exposure
⚡ Rapid Patch Management
The single most effective defence against N-days. Prioritise critical and high-severity patches (CVSS ≥ 7.0) within 14 days; apply all patches within 30 days. Maintain an accurate asset inventory so nothing is missed. For maritime OT, establish remote patch delivery procedures and get vendor approval processes in place before a critical patch is needed.
🛡️ Virtual Patching (IPS/WAF Rules)
When a patch cannot be applied immediately — because the system is critical, the patch has not been tested, or the system is at sea — a virtual patch can block exploitation without modifying the vulnerable software. An Intrusion Prevention System (IPS) or Web Application Firewall (WAF) rule is created that blocks the specific traffic pattern the exploit uses. Virtual patching buys time; it is not a permanent fix.
🔒 Network Segmentation
Even if a zero-day compromises one system, segmentation limits lateral movement. On a vessel, the OT network (engine management, cargo, navigation) must be isolated from the IT network (crew internet, administrative systems). A zero-day exploited through a crew laptop should never reach the bridge systems. IACS UR E26 mandates this separation. In practice, it is one of the most commonly failed controls on vessel assessments.
🔍 Threat Intelligence & Vulnerability Monitoring
Subscribe to CVE feeds (NVD, CISA KEV) and vendor security bulletins. The CISA Known Exploited Vulnerabilities (KEV) catalogue lists CVEs confirmed to be actively exploited in the wild — these must be treated as highest priority. For maritime, BIMCO and IACS publish security advisories relevant to vessel systems. Know what software you run so you can act when a relevant CVE drops.
🚫 Attack Surface Reduction
Disable unused services, close unnecessary ports, remove unneeded software, and block USB ports where chart updates can be delivered via other means. Every service that is not running cannot be exploited. Applying the principle of least privilege — users and systems have only the access they need — limits what an attacker can do even after a zero-day gives them initial access.
🔎 Behavioural Detection (EDR / SIEM)
Zero-days have no signatures — but exploits produce behaviour. An EDR (Endpoint Detection and Response) tool monitors for anomalous process creation, unusual network connections, and privilege escalation attempts that are characteristic of post-exploitation activity, even when the initial vulnerability is unknown. Connecting vessel systems to a shore-based SIEM enables detection and response within the exploitation window, rather than discovering an incident months later.
- A zero-day is a vulnerability unknown to the vendor — no patch, no CVE, no signature. The attacker has an unconstrained exploitation window.
- N-days (known but unpatched vulnerabilities) cause far more real-world damage than zero-days because the majority of organisations patch slowly and attackers know it.
- EternalBlue/WannaCry demonstrated that an N-day with a two-month-old patch can cause USD 300 million in maritime losses. Maersk had the patch; they had not applied it.
- Log4Shell showed that zero-days can exist in hidden dependencies — software embedded in products without the operator's knowledge, making software inventory essential.
- Maritime OT systems face extended zero-day windows due to infrequent patch cycles, legacy OS, and limited monitoring — a combination that turns N-days into effectively permanent vulnerabilities.
- IACS UR E26 mandates vulnerability management and network segmentation — the two controls most directly addressing zero-day and N-day risk on vessels.
- Defences: rapid patch management, virtual patching for systems that cannot be patched immediately, network segmentation to limit blast radius, and behavioural detection (EDR/SIEM) to catch post-exploitation activity without known signatures.
Lesson 13 — DNS Spoofing & DNS-based Attacks closes PART 2 by examining the Domain Name System — the internet's phone book — and how attackers manipulate DNS to redirect traffic, intercept communications, and launch cache poisoning attacks. We also cover DNS over HTTPS/TLS and how maritime vessels are affected by DNS manipulation through satellite channels.
⚓ Join the ShipPaulJobs Community
Join →
Comments
Post a Comment